вЂњWe have observed, for example, a вЂMiddle EastвЂ™ neuron with an association with terrorism,вЂќ OpenAI writes, вЂњand an вЂimmigrationвЂ™ neuron that responds to Latin America. The вЂњSpider-man neuronвЂќ in the neural network can be shown to respond to the collection of ideas relating to Spider-man and spiders, for instance but other parts of the network group together concepts that may be better separated out. Photograph: OpenAIД«ut that shorthand can also lead to problems, of which вЂњtypographic attacksвЂќ are just the top level. вЂWhen we put a label saying вЂњiPodвЂќ on this Granny Smith apple, the model erroneously classifies it as an iPod in the zero-shot setting,вЂ™ OpenAI says. In other words, just like how human brains are thought to work, the AI thinks about the world in terms of ideas and concepts, rather than purely visual structures. вЂњWe discover that the highest layers of Clip organise images as a loose semantic collection of ideas,вЂќ OpenAI says, вЂњproviding a simple explanation for both the modelвЂ™s versatility and the representationвЂ™s compactnessвЂќ. That means, for instance, that it can understand that a photo of Spider-man, a stylised drawing of the superhero, or even the word вЂњspiderвЂќ all refer to the same basic thing вЂ“ but also that it can sometimes fail to recognise the important differences between those categories. Unlike older AIs, Clip is capable of thinking about objects not just on a visual level, but also in a more вЂњconceptualвЂќ way.

While the labвЂ™s latest discovery raises the prospect of fooling AI systems with nothing more complex than a T-shirt, OpenAI says the weakness is a reflection of some underlying strengths of its image recognition system. But both have made huge advances in what was thought possible in their domains: GPT-3 famously wrote a Guardian comment piece last year, while Clip has shown an ability to recognise the real world better than almost all similar approaches. Like GPT-3, the last AI system made by the lab to hit the front pages, Clip is more a proof of concept than a commercial product. This attack works in the wild вЂ¦ but it requires no more technology than pen and paper.вЂќ вЂњBy exploiting the modelвЂ™s ability to read text robustly, we find that even photographs of handwritten text can often fool the model. вЂњWe believe attacks such as those described above are far from simply an academic concern,вЂќ the organisation said in a paper published this week. OpenAI, the machine learning research organisation that created Clip, calls this weakness a вЂњtypographic attackвЂќ. An image of a poodle is labelled вЂpoodleвЂ™, and an image of a poodle with $$$ pasted over it is labelled вЂpiggybankвЂ™.

Pen and paper image